WooYun WhiteHatFest 2016の発表資料です。

2. Through the Competitive World of Bug Bounty
Find Blue Oceans

3. Muneaki Nishimura (nishimunea)
Weekend Bug Hunter
Lecturer of Web Security of Security Camp in Japan

4. Found 30 Bugs in Firefox
Received Reward of $70,000+ from Mozilla
Bug 1065909 Bug 1109276 Bug 1162018 Bug 1196740 Bug 1223743
Bug 1069762 Bug 1148328 Bug 1162411 Bug 1198078 Bug 1224529
Bug 1080987 Bug 1149094 Bug 1164397 Bug 1207556 Bug 1224906
Bug 1101158 Bug 1157216 Bug 1190038 Bug 1208520 Bug 1224910
Bug 1102204 Bug 1158715 Bug 1190139 Bug 1208525 Bug 1227462
Bug 1106713 Bug 1160069 Bug 1192595 Bug 1208956 Bug 1258188

5. Bug Bounty Programs are Competitive
Required a lot of time and techniques to avoid duplicates
1084981 - Poodlebleed
https://bugzilla.mozilla.org/show_bug.cgi?id=1084981

6. Weekdays
Weekend
4:00 7:00
Hunt
Hunt
4:00 7:00
Hunting Time is Limited (4:00-7:00 AM)

7. Give you some tips from my experience of Firefox bug bounty program
Find and Create Uncontested Bounty Targets

8. ”Fox-keh" (C) 2006 Mozilla Japan
Tip #1
Find Bugs in Web Platforms

9. • Browsers and networking features in OS are less competitive targets
• There are common pitfalls but not widely known
• Developers make similar mistakes whenever they introduce new features

11. and try the same attack scenario on similar features
Learn Known Bugs from Security Advisories
Mozilla Foundation Security Advisories
https://www.mozilla.org/en-US/security/advisories/

12. Example
Improper Handling of HTTP Redirect

13. evil.serverbrowser victim.server
Request to victim
Location: evil
Redirect to evil
Final response from evil
HTTP redirects

14. if( request.url.indexOf('http://victim.server/') === 0 )
{
resource = http.get(request.url);
parse(resource);
}
Developers expect following code properly gets a response only from victim

15. if( request.url.indexOf('http://victim.server/') === 0 )
{
resource = http.get(request.url);
parse(resource);
}
But still possible to load a resource from evil
Resource from evil might be used due to redirect
http.get(request.url);

16. Similar bugs were found other than Firefox
• Bug 1111834 - Cross-origin restriction bypass in navigator.sendBeacon
• Bug 1164397 - Origin confusion in cache data of Service Workers
• Bug 1196740 - Cross-origin restriction bypass in Subresource Integrity (SRI)
Firefox
• CVE-2015-6762 - Cross-origin restriction bypass in CSS Font Loading APIChrome
• CVE-2016-1782 - Non-http port banning bypass in WebKitSafari

17. ”Fox-keh" (C) 2006 Mozilla Japan
Tip #2
Find Bugs in Unstable Features

18. Firefox Nightly Builds
https://nightly.mozilla.org/

19. e.g., Firefox Nightly, Chrome Beta and Dev
Unstable Features in Dev. Builds are Eligible for Bounty

20. Example
Subresource Integrity (SRI)

21. 2015.08.13
SRI has been enabled in Nightly

22. 2015.08.20
Reported the first security bug in SRI
After 7 days
2015.08.13
SRI has been enabled in Nightly

23. Reported an origin confusion (Bug 1162018) on Nightly 41 at 2015.05
2016.01 - Implemented Service Workers on Firefox 44
Reported a privilege escalation (Bug 1227462) on Nightly 45 at 2015.11
2016.08 - Planned to introduce Web Extensions on Firefox 48
Reported a sandbox bypass (Bug 1106713) on Nightly 37 at 2014.12
2015.12 - Determined not to support HTML Imports on Firefox

24. ”Fox-keh" (C) 2006 Mozilla Japan
Tip #3
Find Bugs in Sub Products

25. • Smartphones and Smart TV OS
based on Firefox browser
• All applications are made with
HTML5New bland name is B2G OS

26. All applications are made with HTML5

27. All applications are made with HTML5
Type <s>pwn

28. All applications are made with HTML5

29. Yes, we know

30. • Pre-installed applications run with higher privilege
• Protected with Content Security Policy (CSP)
i.e. XSS doesn’t work
• But HTML tag injection still works fine

31. Example
Special Iframe Tag Injection

32. <iframe mozbrowser remote
mozapp='app://fm.gaiamobile.org/manifest.webapp’
src='app://fm.gaiamobile.org/index.html' />
Firefox OS supports special iframe that can embed another app in the frame
Embed FM Radio app.

33. Inject special iframe
Type <iframe mozbrowser mozapp…>

34. FM Radio works

35. Finally reported 7 similar bugs and
Received reward of $20,000+ from Mozilla
Bug 1065909 Bug 1109276 Bug 1162018 Bug 1196740 Bug 1223743
Bug 1069762 Bug 1148328 Bug 1162411 Bug 1198078 Bug 1224529
Bug 1080987 Bug 1149094 Bug 1164397 Bug 1207556 Bug 1224906
Bug 1101158 Bug 1157216 Bug 1190038 Bug 1208520 Bug 1224910
Bug 1102204 Bug 1158715 Bug 1190139 Bug 1208525 Bug 1227462
Bug 1106713 Bug 1160069 Bug 1192595 Bug 1208956 Bug 1258188

36. Firefox for Android

37. • Firefox for Android is also in scope of their bounty program
• There are many Android specific features and pitfalls
e.g. improper intent handling

38. Example
UXSS in Intent URL Scheme

39. <a href='intent://maps.google.com/maps#Intent;scheme=http;
package=com.google.android.apps.map;
S.browser_fallback_url=https%3A%2F%2Fmaps.google.com;end'>
Intent scheme URL links let you launch another app from a web page

40. <a href='intent://maps.google.com/maps#Intent;scheme=http;
package=com.google.android.apps.map;
S.browser_fallback_url=https%3A%2F%2Fmaps.google.com;end'>
Intent scheme URL link let you launch another app from a web page
Application name you want to launch
package=com.google.android.apps.map;
S.browser_fallback_url
Web site URL opened if application doesn’t exist

41. <a href='intent://maps.google.com/maps#Intent;scheme=http;
package=com.google.android.apps.map;
S.browser_fallback_url=javascript%3Aalert(1);end'>
Firefox unintentionally allowed to use any kinds of URL as a fallback
javascript%3Aalert(1)
JavaScript URL also does work

42. Attacker
w = window.open( victim )

43. VictimAttacker

44. VictimAttacker
w.location = 'intent:…'

45. VictimAttacker
Specified JS runs on another origin

46. Firefox for iOS

47. • Firefox for iOS is eligible for a bounty but not officially announced
• Due to Apple’s restriction, Firefox for iOS uses WKWebView for
loading and rendering web contents
• Flaw in WKWebView is ineligible since it’s out of control of Mozilla

48. Example
XSS in Browser Internal Page

49. Firefox for iOS distributes browser internal pages from local web server
http://localhost:6571
/about/home
http://localhost:6571
/about/license
Firefox for Desktop
Firefox for iOS
about:home about:license

50. Feature of Firefox for restoring previous
browsing session after crash
about:sessionrestore

51. • Firefox for iOS hosts session restoration feature on
http://localhost:6571/about/sessionrestore
• Restoring URL can be set by query parameter ”history”

52. mozilla/firefox-ios/SessionRestore.html, Github
https://github.com/mozilla/firefox-ios/blob/6ab27d75e0c3365b1decffff678072a9224f149f/Client/Assets/SessionRestore.html
“history” is parsed as JSON
and finally set to window.location
SessionRestore.html

53. http://localhost:6571/about/sessionrestore?
history= {"history":[” javascript:alert(document.domain) "]}
Any page can trigger XSS on localhost

54. To avoid contested targets
try to find bugs in…
Conclusion
• Web Platform
• Unstable Features
• Sub Products